General
- Target Setup.exe
- Size 19.4MB
- Sample260430-azftcsdy2n
- SHA256 ed3cd15b4d4e33402b935382d02902c91947fbe3f052deec0f48dce8e20d228f
Score
10/10
Malware Config
Targets
-
- Target Setup.exe
- Size 19.4MB
- SHA256 ed3cd15b4d4e33402b935382d02902c91947fbe3f052deec0f48dce8e20d228f
Score10/10Detects Vidar Stealer
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
Looks for VirtualBox Guest Additions in registry
Downloads MZ/PE file
Looks for VMWare Tools registry key
Drops startup file
Executes dropped EXE
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2